3

How can you run a command (e.g. iftop or similar) that requires root privileges from a non-root user and without using SUDO in front?

Alternatively, how can you give root privileges to a user without becoming root?

Ideally, I want to run the iftop command in the following way:

[user@pc]$ iftop

And not like:

[user@pc]$ sudo iftop

[root@pc]$ iftop
3
  • 1
    What is the purpose ? Sounds like an XY-Problem.
    – pLumo
    Mar 25, 2020 at 14:05
  • I cannot run my command as root nor with sudo. So I'm looking for alternatives
    – Adam
    Mar 25, 2020 at 14:08
  • @Adam Why can't you do that?
    – Kusalananda
    Mar 25, 2020 at 15:05

2 Answers 2

3

How can you run a command (e.g. iftop or similar) that requires root privileges from a non-root user and without using SUDO in front?

There are at least 2 methods you can use to allow non-root users use iftop but both of them require root access.

The safer method is to assign cap_net_raw capability to iftop binary:

sudo setcap cap_net_raw+ep "$(command -v iftop)"

The less safe method is to assign setuid root:

sudo chmod +s "$(command -v iftop)"

Alternatively, how can you give root privileges to a user without becoming root?

You can't.

8
  • If I add the root setuid, the iftop command will be run with the root user, right? The best solution for me would be to run a generic binary that requires root privileges but from a non-root user and without sudo.
    – Adam
    Mar 25, 2020 at 14:41
  • @Adam this sounds like a very bad idea.
    – Panki
    Mar 25, 2020 at 14:43
  • It is only for testing purposes, not for production. In any case, is it possible?
    – Adam
    Mar 25, 2020 at 14:47
  • @Adam: yes, it will. The best solution for me would be to run a generic binary that requires root privileges but from a non-root user and without sudo. - why do you need that? If there is a binary you use very often and get tired always typing sudo first the safest way is to assign needed capabilities with setcap, you will not sudo any more. Remember it's a huge security risk to allow unprivileged users on the system to run binaries that should run as root. Mar 25, 2020 at 14:49
  • @Adam: I hope you're at least doing that in a virtual machine or a container and that you're the only user of that system. If that's your situation, you're free to experiment. Mar 25, 2020 at 14:50
0

That can be done using the set user id file attribute:

# chmod u+s /usr/bin/sleep
# sleep 1000&
# ps aux | grep -w sleep | grep -v grep
root   1234  0.0  0.0   ...  0:00 sleep 1000

THIS IS A BIG SECURITY RISK!

If you wish to run something as someone else (not root, as here), that is possible:

# chown pulse /usr/bin/sleep
# chmod u+s /usr/bin/sleep
# sleep 1000&
# ps aux | grep -w sleep | grep -v grep
pulse   1234  0.0  0.0   ...  0:00 sleep 1000

If you are not root you can allow someone else to run a command as you:

# id -nu
john
# ls -l a.out
-rwxr-x--- 1 john users   50923 Mar 25 10:17 a.out
# chmod go+rx,u+s a.out
# ls -l a.out
-rwsr-xr-x 1 john users   50923 Mar 25 10:17 a.out

(please note the "s" where the "x" was in "rwx...". That means the set user id flag is set)

Then, as jane:

# id -nu
jane
# ~john/a.out

That command a.out will be run as john.

4
  • First, it's /usr/bin/sleep. Second, how can you do that as non-root? Mar 25, 2020 at 14:14
  • @ArkadiuszDrabczyk Thanks for pointing out the typo. I have corrected it and added an example as non-root. None of the involved users need to be root. Naturally, you need to set the flag as the person who is to be impersonated and on your own file. Otherwise there would be no security in Linux.
    – Ned64
    Mar 25, 2020 at 14:21
  • OP asked how can you give root privileges to a user without becoming root? . Mar 25, 2020 at 14:23
  • @ArkadiuszDrabczyk Then the second part of my comment has the answer.
    – Ned64
    Mar 25, 2020 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.